<!DOCTYPE html><html lang="zh-CN" data-theme="dark"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>iptables相关规则 | J.のblog</title><meta name="keywords" content="iptables"><meta name="author" content="J."><meta name="copyright" content="J."><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#0d0d0d"><meta name="description" content="一、表与链   filter表 主要和主机自身相关，真正负责主机防火墙功能的（过滤流入流出主机的数据包）filter表示iptbales默认使用的表，这个表定义了3个链（chains）    INPUT 负责过滤所有目标地址是本机地址的数据包，就是过滤进入主机的数据包   FORWARD 负责转发流经主机的数据包。起转发的作用。NAT模式，net.ipv4.ip_forward&#x3D;0">
<meta property="og:type" content="article">
<meta property="og:title" content="iptables相关规则">
<meta property="og:url" content="http://dycloudnavite.love/2020/05/13/iptables%E7%9B%B8%E5%85%B3%E6%8E%A7%E5%88%B6/index.html">
<meta property="og:site_name" content="J.のblog">
<meta property="og:description" content="一、表与链   filter表 主要和主机自身相关，真正负责主机防火墙功能的（过滤流入流出主机的数据包）filter表示iptbales默认使用的表，这个表定义了3个链（chains）    INPUT 负责过滤所有目标地址是本机地址的数据包，就是过滤进入主机的数据包   FORWARD 负责转发流经主机的数据包。起转发的作用。NAT模式，net.ipv4.ip_forward&#x3D;0">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://dycloudnavite.love/img/iptables.png">
<meta property="article:published_time" content="2020-05-13T04:32:00.000Z">
<meta property="article:modified_time" content="2022-08-17T01:14:40.608Z">
<meta property="article:author" content="J.">
<meta property="article:tag" content="iptables">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://dycloudnavite.love/img/iptables.png"><link rel="shortcut icon" href="/dujie5416/img/touxiang.png"><link rel="canonical" href="http://dycloudnavite.love/2020/05/13/iptables%E7%9B%B8%E5%85%B3%E6%8E%A7%E5%88%B6/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/dujie5416/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.min.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/dujie5416/',
  algolia: {"appId":"9GWB2VV7GN","apiKey":"dac56ec5b0b1f45281251ee59db4d637","indexName":"blog","hits":{"per_page":6},"languages":{"input_placeholder":"搜索文章","hits_empty":"找不到您查询的内容：${query}","hits_stats":"找到 ${hits} 条结果，用时 ${time} 毫秒"}},
  localSearch: undefined,
  translate: {"defaultEncoding":2,"translateDelay":0,"msgToTraditionalChinese":"繁","msgToSimplifiedChinese":"簡"},
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: undefined,
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isAnchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'iptables相关规则',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2022-08-17 09:14:40'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><link rel="stylesheet" href="/xxx.css"><link rel="stylesheet" href="/css/universe.css"><link rel="stylesheet" href="/css/custom.css"><style type="text/css">#toggle-sidebar {bottom: 80px}</style><link rel="stylesheet" href="https://fastly.jsdelivr.net/gh/tzy13755126023/BLOG_SOURCE/css/function.min.css"><link rel="stylesheet" href="/css/rightMenu.css"><style type="text/css">#toggle-sidebar {left:100px}</style><!-- hexo injector head_end start --><link rel="stylesheet" href="https://cdn.cbd.int/hexo-butterfly-clock-anzhiyu/lib/clock.min.css" /><!-- hexo injector head_end end --><meta name="generator" content="Hexo 6.2.0"><link rel="alternate" href="/dujie5416/atom.xml" title="J.のblog" type="application/atom+xml">
</head><body><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/dujie5416/img/touxiang.png" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="sidebar-site-data site-data is-center"><a href="/dujie5416/archives/"><div class="headline">文章</div><div class="length-num">73</div></a><a href="/dujie5416/tags/"><div class="headline">标签</div><div class="length-num">17</div></a><a href="/dujie5416/categories/"><div class="headline">分类</div><div class="length-num">11</div></a></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/dujie5416/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('/dujie5416/img/longzhu.png')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/dujie5416/">J.のblog</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/dujie5416/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/dujie5416/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">iptables相关规则</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2020-05-13T04:32:00.000Z" title="发表于 2020-05-13 12:32:00">2020-05-13</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2022-08-17T01:14:40.608Z" title="更新于 2022-08-17 09:14:40">2022-08-17</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/dujie5416/categories/iptables/">iptables</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="iptables相关规则"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"><i class="fa-solid fa-spinner fa-spin"></i></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><h1 id="一、表与链"><a href="#一、表与链" class="headerlink" title="一、表与链"></a>一、表与链</h1><table>
<thead>
<tr>
<th>filter表</th>
<th>主要和主机自身相关，真正负责主机防火墙功能的（过滤流入流出主机的数据包）filter表示iptbales默认使用的表，这个表定义了3个链（chains）</th>
</tr>
</thead>
<tbody><tr>
<td>INPUT</td>
<td>负责过滤所有目标地址是本机地址的数据包，就是过滤进入主机的数据包</td>
</tr>
<tr>
<td>FORWARD</td>
<td>负责转发流经主机的数据包。起转发的作用。NAT模式，net.ipv4.ip_forward&#x3D;0</td>
</tr>
<tr>
<td>OUTPUT</td>
<td>处理所有源地址是本机地址的数据包，就是处理从主机发出去的数据包</td>
</tr>
</tbody></table>
<p>NAT表：</p>
<blockquote>
<p>负责网络地址转换的，即来源与目的IP地址和port的转换。 应用:和主机本身无关，一般用于局域网共享上网或者特殊的端口转换服务相 关。<br><strong>使用场景</strong>:</p>
<blockquote>
<ol>
<li>用于企业路由(zebra)或网关(iptables)，共享上网 (POSTROUTING)</li>
<li>做内部外部IP地址一对一映射(dmz)，硬件防火墙映射IP到内部服务 器，ftp服务(PREROUTING)</li>
<li>WEB，单个端口的映射，直接映射80端口(PREROUTING) 这个表定义 了3个链，nat功能相当于网络的acl控制。和网络交换机acl类似。</li>
</ol>
</blockquote>
</blockquote>
<p>OUTPUT：</p>
<blockquote>
<p>和主机放出去的数据包有关，改变主机发出数据包的目的地址。</p>
</blockquote>
<p>PREROUTING：</p>
<blockquote>
<p>在数据包到达防火墙时，进行路由判断之前执行的规则，作用是改变数据包的 目的地址、目的端口等<br>就是收信时，根据规则重写收件人的地址。 例如:把公网IP:xxx.xxx.xxx.xxx映射到局域网的xx.xx.xx.xx服务器上。 如果是web服务，可以报80转换为局域网的服务器9000端口上<br>10.0.0.61 8080(目标端口) —-nat—à 10.0.0.7 22</p>
</blockquote>
<p>POSTROUTING:</p>
<blockquote>
<p>在数据包离开防火墙时进行路由判断之后执行的规则，作用改变数据包的源地址，源端口等。<br>例如。默认笔记本和虚拟机都是局域网地址，在出网的时候被路由器将源地址改为了公网地址。<br>例如：局域网共享上网。</p>
</blockquote>
<h1 id="二、环境准备及命令"><a href="#二、环境准备及命令" class="headerlink" title="二、环境准备及命令"></a>二、环境准备及命令</h1><h3 id="1、iptables-启动和关闭的命令"><a href="#1、iptables-启动和关闭的命令" class="headerlink" title="1、iptables 启动和关闭的命令"></a>1、iptables 启动和关闭的命令</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell">yum install <span class="token operator">-</span>y  iptables-services
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># rpm -ql   iptables-services</span>
<span class="token operator">/</span>etc/sysconfig/ip6tables
<span class="token operator">/</span>etc/sysconfig/iptables
<span class="token operator">/</span>usr/lib/systemd/system/ip6tables<span class="token punctuation">.</span>service
<span class="token operator">/</span>usr/lib/systemd/system/iptables<span class="token punctuation">.</span>service
防火墙相关模块 加载到内核中
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_state
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># lsmod |egrep 'filter|nat|ipt'</span>
ipt_REJECT             12541  0 
nf_reject_ipv4         13373  1 ipt_REJECT
nf_nat_ftp             12770  0 
nf_conntrack_ftp       18638  1 nf_nat_ftp
iptable_filter         12810  1 
xt_nat                 12681  0 
iptable_nat            12875  0 
nf_nat_ipv4            14115  1 iptable_nat
nf_nat                 26583  3 nf_nat_ftp<span class="token punctuation">,</span>nf_nat_ipv4<span class="token punctuation">,</span>xt_nat
nf_conntrack          137239  7 nf_nat_ftp<span class="token punctuation">,</span>nf_nat<span class="token punctuation">,</span>xt_state<span class="token punctuation">,</span>nf_nat_ipv4<span class="token punctuation">,</span>xt_conntrack<span class="token punctuation">,</span>nf_conntrack_ftp<span class="token punctuation">,</span>nf_conntrack_ipv4
ip_tables              27126  2 iptable_filter<span class="token punctuation">,</span>iptable_nat
libcrc32c              12644  3 xfs<span class="token punctuation">,</span>nf_nat<span class="token punctuation">,</span>nf_conntrack
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># systemctl stop firewalld</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># systemctl disable   firewalld</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># systemctl start iptables.service</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># systemctl enable iptables.service</span>
Created symlink <span class="token keyword">from</span>
<span class="token operator">/</span>etc/systemd/system/basic<span class="token punctuation">.</span>target<span class="token punctuation">.</span>wants/iptables<span class="token punctuation">.</span>service to
<span class="token operator">/</span>usr/lib/systemd/system/iptables<span class="token punctuation">.</span>service<span class="token punctuation">.</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
DROP       icmp <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            icmptype 8

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination     <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<h3 id="2、iptables命令参数"><a href="#2、iptables命令参数" class="headerlink" title="2、iptables命令参数"></a>2、iptables命令参数</h3><blockquote>
<p>-t：指定表 filter(默认) nat<br>-A：append 把规则追加到末尾<br>-I (大写字母I)：insert 把规则插入到规则的第1条 (添加拒绝类规则的时候)<br>-p：protocal 指定协议:tcp &#x2F;udp&#x2F;icmp<br>–dport：destination port 目标端口<br>–sport：source port 源端口<br>-d：dest ip address 目标ip地址<br>-s：source ip address 源ip地址<br>-i：input 数据进来的时候通过的网卡<br>-o：output 数据出去的时候通过的网卡<br>-j：jump 方法 DROP(拒绝) ACCEPT(准许) REJECT(拒绝)<br>-F：清除链中所有的规则<br>-X：清空自定义链的规则<br>-Z：清空计数器<br>-n：不要把端口解析服务名字<br>-L：显示表中的规则<br>–line-number：给每个链中的规则加上行号<br>-D：删除规则 根据规则的号码进行删除   -D INPUT 2</p>
</blockquote>
<h3 id="3、配置filter表规则"><a href="#3、配置filter表规则" class="headerlink" title="3、配置filter表规则"></a>3、配置filter表规则</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -F</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -X</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -Z</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination  <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="4、禁止访问某个端口"><a href="#4、禁止访问某个端口" class="headerlink" title="4、禁止访问某个端口"></a>4、禁止访问某个端口</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -p tcp --dport 22 -j DROP  </span><span aria-hidden="true" class="line-numbers-rows"><span></span></span></code></pre>
<p>删除规则 -D</p>
<pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -D INPUT 1</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination   <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="5、禁止网段连入（禁止10-0-0-0网段-8080端口）"><a href="#5、禁止网段连入（禁止10-0-0-0网段-8080端口）" class="headerlink" title="5、禁止网段连入（禁止10.0.0.0网段 8080端口）"></a>5、禁止网段连入（禁止10.0.0.0网段 8080端口）</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token comment">#在m01已经将10.0.0.0网段的所有主机禁止8080端口连入</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -s 10.0.0.0/24  -p tcp --dport 8080 -j DROP     </span>
<span class="token comment">#可以看见web02已经连接不进去了</span>
<span class="token namespace">[root@web02 ~]</span><span class="token comment"># telnet 10.0.0.61 8080</span>
Trying 10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>61<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>   <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="6、只允许指定网段连入（允许10-0-0-0网段）"><a href="#6、只允许指定网段连入（允许10-0-0-0网段）" class="headerlink" title="6、只允许指定网段连入（允许10.0.0.0网段）"></a>6、只允许指定网段连入（允许10.0.0.0网段）</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT ! -s 10.0.0.0/24 -j DROP</span><span aria-hidden="true" class="line-numbers-rows"><span></span></span></code></pre>
<h3 id="7、指定多个端口"><a href="#7、指定多个端口" class="headerlink" title="7、指定多个端口"></a>7、指定多个端口</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -p tcp -m multiport ! --dport 80,443 -j DROP</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -p tcp  ! --dport 1024:65535 -j DROP   </span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span></span></code></pre>
<h3 id="8、匹配ICMP类型"><a href="#8、匹配ICMP类型" class="headerlink" title="8、匹配ICMP类型"></a>8、匹配ICMP类型</h3><p>ICMP(Internet Control Message Protocol)Internet控制报文协议<br>通过内核参数  控制 禁止被ping</p>
<pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># cat /etc/sysctl.conf</span>
<span class="token comment"># sysctl settings are defined through files in</span>
<span class="token comment"># /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.</span>
<span class="token comment">#</span>
<span class="token comment"># Vendors settings live in /usr/lib/sysctl.d/.</span>
<span class="token comment"># To override a whole file, create a new file with the same in</span>
<span class="token comment"># /etc/sysctl.d/ and put new settings there. To override</span>
<span class="token comment"># only specific settings, add a file with a lexically later</span>
<span class="token comment"># name in /etc/sysctl.d/ and put new settings there.</span>
<span class="token comment">#</span>
<span class="token comment"># For more information, see sysctl.conf(5) and sysctl.d(5).</span>
net<span class="token punctuation">.</span>ipv4<span class="token punctuation">.</span>icmp_echo_ignore_all = 1
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># sysctl -p</span>
net<span class="token punctuation">.</span>ipv4<span class="token punctuation">.</span>icmp_echo_ignore_all = 1<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<p>通过防火墙规则 控制 是否可以被ping</p>
<pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token comment">#在m01防火墙规则上禁止被ping</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -p icmp --icmp-type 8 -j DROP</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
DROP       icmp <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            icmptype 8

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination    
<span class="token comment">#在web01上ping m01可以看到ping不通</span>
<span class="token namespace">[root@web02 ~]</span><span class="token comment"># ping 10.0.0.61</span>
PING 10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>61 <span class="token punctuation">(</span>10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>61<span class="token punctuation">)</span> 56<span class="token punctuation">(</span>84<span class="token punctuation">)</span> bytes of <span class="token keyword">data</span><span class="token punctuation">.</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<h3 id="9、匹配网络状态（TCP-x2F-IP连接状态）"><a href="#9、匹配网络状态（TCP-x2F-IP连接状态）" class="headerlink" title="9、匹配网络状态（TCP&#x2F;IP连接状态）"></a>9、匹配网络状态（TCP&#x2F;IP连接状态）</h3><blockquote>
<p>-m state –state NEW:已经或将启动新的连接 ESTABLISHED:已建立的连接 RELATED:正在启动的新连接 INVALID:非法或无法识别的 iptables -A INPUT -m state –state<br>ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state –state<br>ESTABLISHED,RELATED -j ACCEPT</p>
<p>意思是允许进入的数据包只能是刚刚我发出去的数据包的回应，ESTABLISHED：已建立的链接状态。RELATED：该数据包与本机发出的数据包有关。</p>
</blockquote>
<h3 id="10、限制并发及速率"><a href="#10、限制并发及速率" class="headerlink" title="10、限制并发及速率"></a>10、限制并发及速率</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -I INPUT -p icmp --icmp-type 8 -m limit --limit 6/min --limit-burst 5 -j ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     icmp <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            icmptype 8 limit: avg 6/min burst 5

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination    
<span class="token comment">#-m limit --limit n/&#123;second/minute/hour&#125;;</span>
<span class="token comment">#解释：指定时间内的请求速率“n”为速率，后面为时间，分别为：秒  分  时</span>
<span class="token comment">#--limit-burst [n]</span>
<span class="token comment">#解释：在同一时间内允许通过的请求“n”为数字，不指定默认为5</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="11、防火墙规则的保存与恢复"><a href="#11、防火墙规则的保存与恢复" class="headerlink" title="11、防火墙规则的保存与恢复"></a>11、防火墙规则的保存与恢复</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell">root@m01 ~<span class="token punctuation">]</span><span class="token comment"># cat /etc/sysconfig/iptables</span>
<span class="token comment"># sample configuration for iptables service</span>
<span class="token comment"># you can edit this manually or use system-config-firewall</span>
<span class="token comment"># please do not ask us to add additional ports/services to this default configuration</span>
<span class="token operator">*</span><span class="token keyword">filter</span>
:INPUT ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:FORWARD ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:OUTPUT ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>m state <span class="token operator">--</span>state RELATED<span class="token punctuation">,</span>ESTABLISHED <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>p icmp <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>i lo <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>p tcp <span class="token operator">-</span>m state <span class="token operator">--</span>state NEW <span class="token operator">-</span>m tcp <span class="token operator">--</span>dport 22 <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>j REJECT <span class="token operator">--</span>reject-with icmp-host-prohibited
<span class="token operator">-</span>A FORWARD <span class="token operator">-</span>j REJECT <span class="token operator">--</span>reject-with icmp-host-prohibited
COMMIT
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables-save > /etc/sysconfig/iptables</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># cat /etc/sysconfig/iptables</span>
<span class="token comment"># Generated by iptables-save v1.4.21 on Wed Jul 24 21:00:17 2019</span>
<span class="token operator">*</span><span class="token keyword">filter</span>
:INPUT ACCEPT <span class="token punctuation">[</span>276:25808<span class="token punctuation">]</span>
:FORWARD ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:OUTPUT ACCEPT <span class="token punctuation">[</span>209:23764<span class="token punctuation">]</span>
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>p icmp <span class="token operator">-</span>m icmp <span class="token operator">--</span>icmp-<span class="token function">type</span> 8 <span class="token operator">-</span>m limit <span class="token operator">--</span>limit 6/min <span class="token operator">-</span>j ACCEPT
COMMIT
<span class="token comment"># Completed on Wed Jul 24 21:00:17 2019</span>
<span class="token comment"># Generated by iptables-save v1.4.21 on Wed Jul 24 21:00:17 2019</span>
<span class="token operator">*</span>nat
:PREROUTING ACCEPT <span class="token punctuation">[</span>394:32788<span class="token punctuation">]</span>
:INPUT ACCEPT <span class="token punctuation">[</span>9:616<span class="token punctuation">]</span>
:OUTPUT ACCEPT <span class="token punctuation">[</span>1:148<span class="token punctuation">]</span>
:POSTROUTING ACCEPT <span class="token punctuation">[</span>1:148<span class="token punctuation">]</span>
COMMIT
<span class="token comment"># Completed on Wed Jul 24 21:00:17 2019</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># #恢复</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># #重启防火墙</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -F</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># </span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination    
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables-restore  &lt;/etc/sysconfig/iptables</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL   </span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     icmp <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            icmptype 8 limit: avg 6/min burst 5

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination    <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<h3 id="12、允许本机lo通讯规则"><a href="#12、允许本机lo通讯规则" class="headerlink" title="12、允许本机lo通讯规则"></a>12、允许本机lo通讯规则</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token comment">#允许本机回环lo接口数据流量流出与流入</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A INPUT -i lo -j ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A OUTPUT -o lo -j ACCEPT </span>
<span class="token comment"># 意思就允许本地环回接口在INPUT表的所有数据通信，-i 参数是指定接口，接口是lo，lo就是Loopback（本地环回接口</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span></span></code></pre>
<h3 id="13、配置默认规则及放行80-443-端口"><a href="#13、配置默认规则及放行80-443-端口" class="headerlink" title="13、配置默认规则及放行80  443 端口"></a>13、配置默认规则及放行80  443 端口</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -P INPUT DROP</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -P FORWARD DROP</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -P OUTPUT ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A INPUT -m multiport -p tcp --dport 443,80 -j ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy DROP<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            tcp dpt:22
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            multiport dports 443<span class="token punctuation">,</span>80

Chain FORWARD <span class="token punctuation">(</span>policy DROP<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0  
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A INPUT -s 172.16.1.0/24 -j ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy DROP<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            tcp dpt:22
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            multiport dports 443<span class="token punctuation">,</span>80
ACCEPT     all  <span class="token operator">--</span>  10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/24          0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           
ACCEPT     all  <span class="token operator">--</span>  172<span class="token punctuation">.</span>16<span class="token punctuation">.</span>1<span class="token punctuation">.</span>0/24        0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           

Chain FORWARD <span class="token punctuation">(</span>policy DROP<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0  

<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables-save</span>
<span class="token comment"># Generated by iptables-save v1.4.21 on Wed Jul 24 21:45:21 2019</span>
<span class="token operator">*</span><span class="token keyword">filter</span>
:INPUT DROP <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:FORWARD DROP <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:OUTPUT ACCEPT <span class="token punctuation">[</span>37:6212<span class="token punctuation">]</span>
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>p tcp <span class="token operator">-</span>m tcp <span class="token operator">--</span>dport 22 <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>i lo <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>p tcp <span class="token operator">-</span>m multiport <span class="token operator">--</span>dports 443<span class="token punctuation">,</span>80 <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>s 10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/24 <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A INPUT <span class="token operator">-</span>s 172<span class="token punctuation">.</span>16<span class="token punctuation">.</span>1<span class="token punctuation">.</span>0/24 <span class="token operator">-</span>j ACCEPT
<span class="token operator">-</span>A OUTPUT <span class="token operator">-</span>o lo <span class="token operator">-</span>j ACCEPT
COMMIT
<span class="token comment"># Completed on Wed Jul 24 21:45:21 2019</span>
<span class="token comment"># Generated by iptables-save v1.4.21 on Wed Jul 24 21:45:21 2019</span>
<span class="token operator">*</span>nat
:PREROUTING ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:INPUT ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:OUTPUT ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
:POSTROUTING ACCEPT <span class="token punctuation">[</span>0:0<span class="token punctuation">]</span>
COMMIT
<span class="token comment"># Completed on Wed Jul 24 21:45:21 2019</span>
<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<h1 id="二、nat设置"><a href="#二、nat设置" class="headerlink" title="二、nat设置"></a>二、nat设置</h1><h3 id="1、环境设置"><a href="#1、环境设置" class="headerlink" title="1、环境设置"></a>1、环境设置</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -P INPUT ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -P FORWARD ACCEPT</span>
<span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -nL</span>
Chain INPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            tcp dpt:22
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           
ACCEPT     tcp  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            multiport dports 443<span class="token punctuation">,</span>80
ACCEPT     all  <span class="token operator">--</span>  10<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/24          0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           
ACCEPT     all  <span class="token operator">--</span>  172<span class="token punctuation">.</span>16<span class="token punctuation">.</span>1<span class="token punctuation">.</span>0/24        0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0           

Chain FORWARD <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         

Chain OUTPUT <span class="token punctuation">(</span>policy ACCEPT<span class="token punctuation">)</span>
target     prot opt source               destination         
ACCEPT     all  <span class="token operator">--</span>  0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0            0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0/0  <span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<h3 id="2、实现把访问10-0-0-62-80的请求转发到172-16-1-7-80"><a href="#2、实现把访问10-0-0-62-80的请求转发到172-16-1-7-80" class="headerlink" title="2、实现把访问10.0.0.62:80的请求转发到172.16.1.7:80"></a>2、实现把访问10.0.0.62:80的请求转发到172.16.1.7:80</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell"><span class="token namespace">[root@m01 ~]</span><span class="token comment"># iptables -A PREROUTING -t nat -d 10.0.0.62 -p tcp --dport 80 -j DNAT --to-destination 172.16.1.7:80</span><span aria-hidden="true" class="line-numbers-rows"><span></span></span></code></pre>

<h3 id="3、实现172-16-1-0-x2F-24段所有主机通过124-32-54-26外网IP共享上网。"><a href="#3、实现172-16-1-0-x2F-24段所有主机通过124-32-54-26外网IP共享上网。" class="headerlink" title="3、实现172.16.1.0&#x2F;24段所有主机通过124.32.54.26外网IP共享上网。"></a>3、实现172.16.1.0&#x2F;24段所有主机通过124.32.54.26外网IP共享上网。</h3><pre class="line-numbers language-powershell" data-language="powershell"><code class="language-powershell">iptables  <span class="token operator">-</span>A  POSTROUTING <span class="token operator">-</span>p tcp <span class="token operator">-</span>s 172<span class="token punctuation">.</span>16<span class="token punctuation">.</span>1<span class="token punctuation">.</span>0/24 <span class="token operator">-</span>j SNAT <span class="token operator">--</span>to-source 124<span class="token punctuation">.</span>32<span class="token punctuation">.</span>54<span class="token punctuation">.</span>26

iptables  <span class="token operator">-</span>A  POSTROUTING <span class="token operator">-</span>p tcp <span class="token operator">-</span>s 172<span class="token punctuation">.</span>16<span class="token punctuation">.</span>1<span class="token punctuation">.</span>0/24 <span class="token operator">-</span>j SNAT <span class="token operator">--</span>to-source  MASQUERADE<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span></span></code></pre>

</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="http://dycloudnavite.love">J.</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="http://dycloudnavite.love/2020/05/13/iptables%E7%9B%B8%E5%85%B3%E6%8E%A7%E5%88%B6/">http://dycloudnavite.love/2020/05/13/iptables%E7%9B%B8%E5%85%B3%E6%8E%A7%E5%88%B6/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="http://dycloudnavite.love" target="_blank">J.のblog</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/dujie5416/tags/iptables/">iptables</a></div><div class="post_share"><div class="addthis_inline_share_toolbox"></div><script src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-5d034d84b42927bf" async="async"></script></div></div><div class="post-reward"><div class="reward-button"><i class="fas fa-qrcode"></i> 打赏</div><div class="reward-main"><ul class="reward-all"><li class="reward-item"><a href="/dujie5416/img/wechat.jpg" target="_blank"><img class="post-qr-code-img" src="/dujie5416/img/wechat.jpg" alt="微信"/></a><div class="post-qr-code-desc">微信</div></li><li class="reward-item"><a href="/dujie5416/img/alipay.jpg" target="_blank"><img class="post-qr-code-img" src="/dujie5416/img/alipay.jpg" alt="支付宝"/></a><div class="post-qr-code-desc">支付宝</div></li></ul></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/dujie5416/2020/09/08/centos7%E6%90%AD%E5%BB%BAsvn%E6%9C%8D%E5%8A%A1%E5%99%A8/"><img class="prev-cover" src="/dujie5416/img/svn.png" onerror="onerror=null;src='/dujie5416/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">centos7 安装svn服务器</div></div></a></div><div class="next-post pull-right"><a href="/dujie5416/2020/05/02/pipeline%E5%88%86%E5%B8%83%E5%BC%8F%E6%9E%84%E5%BB%BA%E5%92%8Cpipline%E5%9F%BA%E7%A1%80%E8%AF%AD%E6%B3%95/"><img class="next-cover" src="/dujie5416/img/jenkins.png" onerror="onerror=null;src='/dujie5416/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">pipeline分布式构建和pipline基础语法</div></div></a></div></nav><hr/><div id="post-comment"><div class="comment-head"><div class="comment-headline"><i class="fas fa-comments fa-fw"></i><span> 评论</span></div></div><div class="comment-wrap"><div><div id="lv-container" data-id="city" data-uid="MTAyMC81Njk5OS8zMzQ2Mw=="></div></div></div></div></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="/dujie5416/img/touxiang.png" onerror="this.onerror=null;this.src='/dujie5416/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">J.</div><div class="author-info__description"></div></div><div class="card-info-data site-data is-center"><a href="/dujie5416/archives/"><div class="headline">文章</div><div class="length-num">73</div></a><a href="/dujie5416/tags/"><div class="headline">标签</div><div class="length-num">17</div></a><a href="/dujie5416/categories/"><div class="headline">分类</div><div class="length-num">11</div></a></div></div><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%B8%80%E3%80%81%E8%A1%A8%E4%B8%8E%E9%93%BE"><span class="toc-number">1.</span> <span class="toc-text">一、表与链</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%BA%8C%E3%80%81%E7%8E%AF%E5%A2%83%E5%87%86%E5%A4%87%E5%8F%8A%E5%91%BD%E4%BB%A4"><span class="toc-number">2.</span> <span class="toc-text">二、环境准备及命令</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1%E3%80%81iptables-%E5%90%AF%E5%8A%A8%E5%92%8C%E5%85%B3%E9%97%AD%E7%9A%84%E5%91%BD%E4%BB%A4"><span class="toc-number">2.0.1.</span> <span class="toc-text">1、iptables 启动和关闭的命令</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2%E3%80%81iptables%E5%91%BD%E4%BB%A4%E5%8F%82%E6%95%B0"><span class="toc-number">2.0.2.</span> <span class="toc-text">2、iptables命令参数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3%E3%80%81%E9%85%8D%E7%BD%AEfilter%E8%A1%A8%E8%A7%84%E5%88%99"><span class="toc-number">2.0.3.</span> <span class="toc-text">3、配置filter表规则</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#4%E3%80%81%E7%A6%81%E6%AD%A2%E8%AE%BF%E9%97%AE%E6%9F%90%E4%B8%AA%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.0.4.</span> <span class="toc-text">4、禁止访问某个端口</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#5%E3%80%81%E7%A6%81%E6%AD%A2%E7%BD%91%E6%AE%B5%E8%BF%9E%E5%85%A5%EF%BC%88%E7%A6%81%E6%AD%A210-0-0-0%E7%BD%91%E6%AE%B5-8080%E7%AB%AF%E5%8F%A3%EF%BC%89"><span class="toc-number">2.0.5.</span> <span class="toc-text">5、禁止网段连入（禁止10.0.0.0网段 8080端口）</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#6%E3%80%81%E5%8F%AA%E5%85%81%E8%AE%B8%E6%8C%87%E5%AE%9A%E7%BD%91%E6%AE%B5%E8%BF%9E%E5%85%A5%EF%BC%88%E5%85%81%E8%AE%B810-0-0-0%E7%BD%91%E6%AE%B5%EF%BC%89"><span class="toc-number">2.0.6.</span> <span class="toc-text">6、只允许指定网段连入（允许10.0.0.0网段）</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#7%E3%80%81%E6%8C%87%E5%AE%9A%E5%A4%9A%E4%B8%AA%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.0.7.</span> <span class="toc-text">7、指定多个端口</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#8%E3%80%81%E5%8C%B9%E9%85%8DICMP%E7%B1%BB%E5%9E%8B"><span class="toc-number">2.0.8.</span> <span class="toc-text">8、匹配ICMP类型</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#9%E3%80%81%E5%8C%B9%E9%85%8D%E7%BD%91%E7%BB%9C%E7%8A%B6%E6%80%81%EF%BC%88TCP-x2F-IP%E8%BF%9E%E6%8E%A5%E7%8A%B6%E6%80%81%EF%BC%89"><span class="toc-number">2.0.9.</span> <span class="toc-text">9、匹配网络状态（TCP&#x2F;IP连接状态）</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#10%E3%80%81%E9%99%90%E5%88%B6%E5%B9%B6%E5%8F%91%E5%8F%8A%E9%80%9F%E7%8E%87"><span class="toc-number">2.0.10.</span> <span class="toc-text">10、限制并发及速率</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#11%E3%80%81%E9%98%B2%E7%81%AB%E5%A2%99%E8%A7%84%E5%88%99%E7%9A%84%E4%BF%9D%E5%AD%98%E4%B8%8E%E6%81%A2%E5%A4%8D"><span class="toc-number">2.0.11.</span> <span class="toc-text">11、防火墙规则的保存与恢复</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#12%E3%80%81%E5%85%81%E8%AE%B8%E6%9C%AC%E6%9C%BAlo%E9%80%9A%E8%AE%AF%E8%A7%84%E5%88%99"><span class="toc-number">2.0.12.</span> <span class="toc-text">12、允许本机lo通讯规则</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#13%E3%80%81%E9%85%8D%E7%BD%AE%E9%BB%98%E8%AE%A4%E8%A7%84%E5%88%99%E5%8F%8A%E6%94%BE%E8%A1%8C80-443-%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.0.13.</span> <span class="toc-text">13、配置默认规则及放行80  443 端口</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%BA%8C%E3%80%81nat%E8%AE%BE%E7%BD%AE"><span class="toc-number">3.</span> <span class="toc-text">二、nat设置</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1%E3%80%81%E7%8E%AF%E5%A2%83%E8%AE%BE%E7%BD%AE"><span class="toc-number">3.0.1.</span> <span class="toc-text">1、环境设置</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2%E3%80%81%E5%AE%9E%E7%8E%B0%E6%8A%8A%E8%AE%BF%E9%97%AE10-0-0-62-80%E7%9A%84%E8%AF%B7%E6%B1%82%E8%BD%AC%E5%8F%91%E5%88%B0172-16-1-7-80"><span class="toc-number">3.0.2.</span> <span class="toc-text">2、实现把访问10.0.0.62:80的请求转发到172.16.1.7:80</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3%E3%80%81%E5%AE%9E%E7%8E%B0172-16-1-0-x2F-24%E6%AE%B5%E6%89%80%E6%9C%89%E4%B8%BB%E6%9C%BA%E9%80%9A%E8%BF%87124-32-54-26%E5%A4%96%E7%BD%91IP%E5%85%B1%E4%BA%AB%E4%B8%8A%E7%BD%91%E3%80%82"><span class="toc-number">3.0.3.</span> <span class="toc-text">3、实现172.16.1.0&#x2F;24段所有主机通过124.32.54.26外网IP共享上网。</span></a></li></ol></li></ol></li></ol></div></div><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/dujie5416/2023/07/29/%E6%A0%B9%E6%8D%AErouter%E6%98%BE%E7%A4%BA%E5%B7%A6%E4%BE%A7%E8%8F%9C%E5%8D%95%E6%A0%8F%E9%9A%90%E8%97%8F%E6%9F%90%E4%B8%AA%E8%8F%9C%E5%8D%95%E9%80%89%E9%A1%B9/" title="vue3左侧菜单隐藏某选项"><img src="/dujie5416/img/golang.png" onerror="this.onerror=null;this.src='/dujie5416/img/404.jpg'" alt="vue3左侧菜单隐藏某选项"/></a><div class="content"><a class="title" href="/dujie5416/2023/07/29/%E6%A0%B9%E6%8D%AErouter%E6%98%BE%E7%A4%BA%E5%B7%A6%E4%BE%A7%E8%8F%9C%E5%8D%95%E6%A0%8F%E9%9A%90%E8%97%8F%E6%9F%90%E4%B8%AA%E8%8F%9C%E5%8D%95%E9%80%89%E9%A1%B9/" title="vue3左侧菜单隐藏某选项">vue3左侧菜单隐藏某选项</a><time datetime="2023-07-29T06:32:00.000Z" title="发表于 2023-07-29 14:32:00">2023-07-29</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/dujie5416/2023/07/13/Vue%E7%8A%B6%E6%80%81%E7%AE%A1%E7%90%86/" title="Vue状态管理"><img src="/dujie5416/img/golang.png" onerror="this.onerror=null;this.src='/dujie5416/img/404.jpg'" alt="Vue状态管理"/></a><div class="content"><a class="title" href="/dujie5416/2023/07/13/Vue%E7%8A%B6%E6%80%81%E7%AE%A1%E7%90%86/" title="Vue状态管理">Vue状态管理</a><time datetime="2023-07-13T09:29:00.000Z" title="发表于 2023-07-13 17:29:00">2023-07-13</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/dujie5416/2023/06/27/%E5%9F%BA%E4%BA%8EIOC%E8%A7%A3%E5%86%B3%E5%AF%B9%E8%B1%A1%E4%BE%9D%E8%B5%96%E9%97%AE%E9%A2%98/" title="基于IOC解决对象依赖问题"><img src="/dujie5416/img/golang.png" onerror="this.onerror=null;this.src='/dujie5416/img/404.jpg'" alt="基于IOC解决对象依赖问题"/></a><div class="content"><a class="title" href="/dujie5416/2023/06/27/%E5%9F%BA%E4%BA%8EIOC%E8%A7%A3%E5%86%B3%E5%AF%B9%E8%B1%A1%E4%BE%9D%E8%B5%96%E9%97%AE%E9%A2%98/" title="基于IOC解决对象依赖问题">基于IOC解决对象依赖问题</a><time datetime="2023-06-27T03:32:00.000Z" title="发表于 2023-06-27 11:32:00">2023-06-27</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/dujie5416/2023/06/23/Gin%E6%A1%86%E6%9E%B6/" title="Gin框架"><img src="/dujie5416/img/golang.png" onerror="this.onerror=null;this.src='/dujie5416/img/404.jpg'" alt="Gin框架"/></a><div class="content"><a class="title" href="/dujie5416/2023/06/23/Gin%E6%A1%86%E6%9E%B6/" title="Gin框架">Gin框架</a><time datetime="2023-06-23T06:32:00.000Z" title="发表于 2023-06-23 14:32:00">2023-06-23</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/dujie5416/2023/06/04/ServeMux%E3%80%81httprouter/" title="ServeMux、httprouter"><img src="/dujie5416/img/golang.png" onerror="this.onerror=null;this.src='/dujie5416/img/404.jpg'" alt="ServeMux、httprouter"/></a><div class="content"><a class="title" href="/dujie5416/2023/06/04/ServeMux%E3%80%81httprouter/" title="ServeMux、httprouter">ServeMux、httprouter</a><time datetime="2023-06-04T03:32:00.000Z" title="发表于 2023-06-04 11:32:00">2023-06-04</time></div></div></div></div></div></div></main><footer id="footer" style="background-image: url('/dujie5416/img/longzhu.png')"><div id="footer-wrap"><div class="copyright">&copy;2019 - 2024  <i id="heartbeat" class="fa fas fa-heartbeat"></i> J.</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a><a href="http://beian.miit.gov.cn/"  style="color:#f72b07" target="_blank">京ICP备2022023567号</a></div></div><link rel="stylesheet" href="https://fastly.jsdelivr.net/gh/HCLonely/images@master/others/heartbeat.min.css"></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="translateLink" type="button" title="简繁转换">繁</button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><a id="to_comment" href="#post-comment" title="直达评论"><i class="fas fa-comments"></i></a><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="algolia-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">搜索</span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="search-wrap"><div id="algolia-search-input"></div><hr/><div id="algolia-search-results"><div id="algolia-hits"></div><div id="algolia-pagination"></div><div id="algolia-info"><div class="algolia-stats"></div><div class="algolia-poweredBy"></div></div></div></div></div><div id="search-mask"></div></div><div id="rightMenu"><div class="rightMenu-group rightMenu-small"><div class="rightMenu-item" id="menu-backward"><i class="fa-solid fa-arrow-left"></i></div><div class="rightMenu-item" id="menu-forward"><i class="fa-solid fa-arrow-right"></i></div><div class="rightMenu-item" id="menu-refresh"><i class="fa-solid fa-arrow-rotate-right"></i></div><div class="rightMenu-item" id="menu-home"><i class="fa-solid fa-house"></i></div></div><div class="rightMenu-group rightMenu-line rightMenuOther"><a class="rightMenu-item menu-link" href="/archives/"><i class="fa-solid fa-archive"></i><span>文章归档</span></a><a class="rightMenu-item menu-link" href="/categories/"><i class="fa-solid fa-folder-open"></i><span>文章分类</span></a><a class="rightMenu-item menu-link" href="/tags/"><i class="fa-solid fa-tags"></i><span>文章标签</span></a></div><div class="rightMenu-group rightMenu-line rightMenuNormal"><a class="rightMenu-item menu-link" id="menu-radompage" href="/random/index.html"><i class="fa-solid fa-shoe-prints"></i><span>随便逛逛</span></a><div class="rightMenu-item" id="menu-translate"><i class="fa-solid fa-earth-asia"></i><span>繁简切换</span></div><div class="rightMenu-item" id="menu-darkmode"><i class="fa-solid fa-moon"></i><span>切换模式</span></div></div></div><div id="rightmenu-mask"></div><div><script src="/dujie5416/js/utils.js"></script><script src="/dujie5416/js/main.js"></script><script src="/dujie5416/js/tw_cn.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.min.js"></script><script src="https://cdn.jsdelivr.net/npm/algoliasearch/dist/algoliasearch-lite.umd.min.js"></script><script src="https://cdn.jsdelivr.net/npm/instantsearch.js/dist/instantsearch.production.min.js"></script><script src="/dujie5416/js/search/algolia.js"></script><script>var preloader = {
  endLoading: () => {
    document.body.style.overflow = 'auto';
    document.getElementById('loading-box').classList.add("loaded")
  },
  initLoading: () => {
    document.body.style.overflow = '';
    document.getElementById('loading-box').classList.remove("loaded")

  }
}
window.addEventListener('load',preloader.endLoading())</script><div class="js-pjax"><script>function loadLivere () {
  if (typeof LivereTower === 'object') {
    window.LivereTower.init()
  }
  else {
    (function(d, s) {
        var j, e = d.getElementsByTagName(s)[0];
        if (typeof LivereTower === 'function') { return; }
        j = d.createElement(s);
        j.src = 'https://cdn-city.livere.com/js/embed.dist.js';
        j.async = true;
        e.parentNode.insertBefore(j, e);
    })(document, 'script');
  }
}

if ('Livere' === 'Livere' || !false) {
  if (false) btf.loadComment(document.getElementById('lv-container'), loadLivere)
  else loadLivere()
}
else {
  function loadOtherComment () {
    loadLivere()
  }
}</script></div><script defer src="https://npm.elemecdn.com/jquery@latest/dist/jquery.min.js"></script><script data-pjax defer src="https://npm.elemecdn.com/tzy-blog/lib/js/theme/chocolate.js"></script><canvas id="universe"></canvas><script defer src="/js/universe.js"></script><script defer data-pjax src="/js/rightMenu.js"></script><div class="aplayer no-destroy" data-id="7427714271" data-server="netease" data-type="playlist" data-fixed="true" data-mini="true" data-listFolded="false" data-order="random" data-lrctype="1" data-preload="none" data-autoplay="true" muted></div><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/dist/click-show-text.min.js" data-mobile="false" data-text="I,LOVE,YOU" data-fontsize="15px" data-random="false" async="async"></script><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/aplayer/dist/APlayer.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/aplayer/dist/APlayer.min.js"></script><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/metingjs/dist/Meting.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pjax/pjax.min.js"></script><script>let pjaxSelectors = ["meta[property=\"og:image\"]","meta[property=\"og:title\"]","meta[property=\"og:url\"]","head > title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]

var pjax = new Pjax({
  elements: 'a:not([target="_blank"])',
  selectors: pjaxSelectors,
  cacheBust: false,
  analytics: false,
  scrollRestoration: false
})

document.addEventListener('pjax:send', function () {

  // removeEventListener scroll 
  window.tocScrollFn && window.removeEventListener('scroll', window.tocScrollFn)
  window.scrollCollect && window.removeEventListener('scroll', scrollCollect)

  typeof preloader === 'object' && preloader.initLoading()
  document.getElementById('rightside').style.cssText = "opacity: ''; transform: ''"
  
  if (window.aplayers) {
    for (let i = 0; i < window.aplayers.length; i++) {
      if (!window.aplayers[i].options.fixed) {
        window.aplayers[i].destroy()
      }
    }
  }

  typeof typed === 'object' && typed.destroy()

  //reset readmode
  const $bodyClassList = document.body.classList
  $bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')

  typeof disqusjs === 'object' && disqusjs.destroy()
})

document.addEventListener('pjax:complete', function () {
  window.refreshFn()

  document.querySelectorAll('script[data-pjax]').forEach(item => {
    const newScript = document.createElement('script')
    const content = item.text || item.textContent || item.innerHTML || ""
    Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
    newScript.appendChild(document.createTextNode(content))
    item.parentNode.replaceChild(newScript, item)
  })

  GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()

  typeof chatBtnFn === 'function' && chatBtnFn()
  typeof panguInit === 'function' && panguInit()

  // google analytics
  typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});

  // baidu analytics
  typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);

  typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()

  // prismjs
  typeof Prism === 'object' && Prism.highlightAll()

  typeof preloader === 'object' && preloader.endLoading()
})

document.addEventListener('pjax:error', (e) => {
  if (e.request.status === 404) {
    pjax.loadUrl('/404.html')
  }
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><!-- hexo injector body_end start --><script data-pjax>
  function butterfly_clock_anzhiyu_injector_config(){
    var parent_div_git = document.getElementsByClassName('sticky_layout')[0];
    var item_html = '<div class="card-widget card-clock"><div class="card-glass"><div class="card-background"><div class="card-content"><div id="hexo_electric_clock"><img class="entered loading" id="card-clock-loading" src="https://cdn.cbd.int/hexo-butterfly-clock-anzhiyu/lib/loading.gif" style="height: 120px; width: 100%;" data-ll-status="loading"/></div></div></div></div></div>';
    console.log('已挂载butterfly_clock_anzhiyu')
    if(parent_div_git) {
      parent_div_git.insertAdjacentHTML("afterbegin",item_html)
    }
  }
  var elist = 'null'.split(',');
  var cpage = location.pathname;
  var epage = 'all';
  var qweather_key = '56289903f0d448dfbe8262dba0175f70';
  var gaud_map_key = '01603f2b2d08d0e947bb101e9d9b148b';
  var baidu_ak_key = 'undefined';
  var flag = 0;
  var clock_rectangle = '112.982279,28.19409';
  var clock_default_rectangle_enable = 'false';

  for (var i=0;i<elist.length;i++){
    if (cpage.includes(elist[i])){
      flag++;
    }
  }

  if ((epage ==='all')&&(flag == 0)){
    butterfly_clock_anzhiyu_injector_config();
  }
  else if (epage === cpage){
    butterfly_clock_anzhiyu_injector_config();
  }
  </script><script src="https://widget.qweather.net/simple/static/js/he-simple-common.js?v=2.0"></script><script data-pjax src="https://cdn.cbd.int/hexo-butterfly-clock-anzhiyu/lib/clock.min.js"></script><!-- hexo injector body_end end --><script src="/dujie5416/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"tagMode":false,"debug":false,"model":{"jsonPath":"/dujie5416/live2dw/assets/tororo.model.json"},"display":{"position":"right","width":150,"height":350,"hOffset":20,"vOffset":-20},"mobile":{"show":false},"log":false,"pluginJsPath":"lib/","pluginModelPath":"assets/","pluginRootPath":"live2dw/"});</script><script async>window.onload=function(){var a=document.createElement('script'),b=document.getElementsByTagName('script')[0];a.type='text/javascript',a.async=!0,a.src='/sw-register.js?v='+Date.now(),b.parentNode.insertBefore(a,b)};</script></body></html>